Can Biometrics Replace Passwords?

Abstract

The threat of malware and phishing is engulfing the web. It is expected to be an even greater threat in the mobile context as battery power limitations and the lack of handset screen real estate hinder anti-virus and user messaging methods. In addition, people’s continuous handset connectivity makes them more vulnerable to abuse. This paper argues that biometric methods such as fingerprinting could address a large part of this towering threat—but only if properly architected. We describe an architecture that is practically attainable, which would address the problem in a meaningful way, and argue that this is a promising direction—both in terms of security and usability.